Intel Corporation

Mcafee, Inc.

Disney Enterprises, Inc.

Other

Hewlett-Packard Development Company, L.p.

David M Durham

Ravi L Sahita

Siddhartha Chhabra

Michael Lemay

Karanvir S Grewal

Sergej Deutsch

Uday R Savagaonkar

Prashant Dewan

Gilbert A Neiger

Michael E Kounavis

Men Long

Hormuzd M Khosravi

Baiju V Patel

Barry E Huntley

Vedvyas Shanbhogue

Alpa T Narendra Trivedi

Travis T Schluessler

Andrew V Anderson

Santosh Ghosh

Carlos V Rozas

Deepak K Gupta

Rajat Agarwal

Abhishek Basak

Balaji Vembu

Jason W Brandt

Ioannis T Schoinas

Gideon Gerzon

Michael A Goldsmith

David Crawford

John Douglas Teddy

Francis X Mckeen

Ron Gabor

Russell Jerome Fenger

Vincent J Zimmer

Kirk S Yap

Vincent R Scarlata

Scott Dion Rodgers

David A Koufaty

Asit K Mallick

Ned M Smith

Rajesh M Sankaran

Kapil Sood

Richard A Uhlig

John I Garney

Jr-Shian Tsai

Ernie F Brickell

Simon P Johnson

Howard C Herbert

Gary L Graunke

Dion Rodgers

Vadim Sukhomlinov

Stanislav Shwartsman

Jason Martin

Robert S Chappell

Stephen R Van Doren

Ronak Singhal

Stalinselvaraj Jeyasingh

Sailesh Kottapalli

Kshitij Arun Doshi

Manoj R Sastry

Geoffrey S Strongin

Alex Nayshtut

Sreenivas Subramoney

Scott R Janus

Oleg Pogorelik

Uttam K Sengupta

Wei Wu

Sanjay Bakshi

Robert L Vaughn

Xiaoning Li

Lenitra M Durham

Jayesh Gaur

Cedric Cochin

Nikhil M Deshpande

Mohan J Kumar

Shay Gueron

Patrick L Connor

Jesse R Walker

Hong C Li

Ravishankar Iyer

Raanan Sade

Andrew J Herdrich

Arvind A Kumar

James P Kardach

Sara S Baghsorkhi

Raj K Ramanujan

Ittai Anati

Anatoli Aleksandrovich Bolotov

Omer Ben-Shalom

Parthasarathy Sarangam

Ravi Rajwar

Mikhail I Grinchuk

Alexander Bachmutsky

Dan Baum

Niranjan L Cooray

Mingqiu Sun

Ronald Perez

Ian M Steiner

Beeman C Strong

Alpa Narendra Trivedi

Methods and apparatus relating to zero-redundancy tag storage for bucketed allocators are described. In some embodiments, memory stores a memory page. The memory page includes a metadata page and a plurality of slots. The metadata page includes information corresponding to the plurality of slots. Decode circuitry decodes an instruction that includes a source operand. Execution circuitry executes the decoded instruction according to the source operand to load a first tag for a first slot of the plurality of slots in response to a memory access request directed at the first slot of the plurality of slots. The memory access request is allowed to proceed in response to a match between the first tag and a second tag of a pointer of the memory access request. The memory page stores a separate tag in proximity to each of the plurality of slots. Other embodiments are also disclosed and claimed.

Zero-redundancy tag storage for bucketed allocators

Methods, apparatus, systems, and articles of manufacture are disclosed that perform bounds checking on authorized memory allocations during pointer arithmetic. In some examples, instruction decode circuitry decodes an update pointer instruction for a pointer. In some examples, bounds checking circuitry determines an authorized allocation for the pointer, determines one or more exclusion zones and poison zones for the pointer. In some examples, bounds checking circuitry updates the pointer and generates a fault if the pointer points to one of the exclusion zones and poisons the pointer if the pointer points to one of the poison zones.

Apparatus, computer-readable medium, and method for reducing bounds checking overhead by instrumenting pointer arithmetic

In one embodiment, a processor includes a memory hierarchy that stores encrypted data, tracking circuitry that tracks an execution context for instructions executed by the processor, and cryptographic computing circuitry to encrypt/decrypt data that is stored in the memory hierarchy. The cryptographic computing circuitry obtains context information from the tracking circuitry for a load instruction to be executed by the processor, where the context information indicates information about branch predictions made by a branch prediction unit of the processor, and decrypts the encrypted data using a key and the context information as a tweak input to the decryption.

Cryptographic computing with context information for transient side channel security

In one embodiment, a multi-tenant computing system includes a processor including a plurality of cores on which agents of tenants of the multi-tenant computing system are to execute, a configuration storage, and a memory execution circuit. The configuration storage includes a first configuration register to store configuration information associated with the memory execution circuit. The first configuration register is to store a mode identifier to identify a mode of operation of the memory execution circuit. The memory execution circuit, in a first mode of operation, is to receive encrypted data of a first tenant, the encrypted data encrypted by the first tenant, generate an integrity value for the encrypted data, and send the encrypted data and the integrity value to a memory, the integrity value not visible to the software of the multi-tenant computing system. Other embodiments are described and claimed.

System, apparatus and method for integrity protecting tenant workloads in a multi-tenant computing environment

Systems, methods, and apparatuses for implementing micro-context based trust domains are described. In one example, a system includes a hardware processor core to implement a trust domain manager to manage one or more hardware isolated virtual machines as a respective trust domain with a region of protected memory, and assign a micro-context identification value, that is not readable by privileged system code that is to execute on the hardware processor core, to each granule of a plurality of granules of physical memory of the protected memory (e.g., where a granule is a proper subset of a page of memory relating to a single object in memory); and a memory management circuit coupled between the hardware processor core and the physical memory, wherein the memory management circuit is to prevent data in the protected memory having a first micro-context identification value from being accessed by code based on the code having a different micro-context identification value.

Circuitry and methods for implementing micro-context based trust domains

Systems and methods for memory isolation are provided. The methods include receiving a request to write a data line to a physical memory address, where the physical memory address includes a key identifier, selecting an encryption key from a key table based on the key identifier of the physical memory address, determining whether the data line is compressible, compressing the data line to generate a compressed line in response to determining that the data line is compressible, where the compressed line includes compression metadata and compressed data, adding encryption metadata to the compressed line, where the encryption metadata is indicative of the encryption key, encrypting a part of the compressed line with the encryption key to generate an encrypted line in response to adding the encryption metadata, and writing the encrypted line to a memory device at the physical memory address. Other embodiments are described and claimed.

Technologies for memory replay prevention using compressive encryption

Techniques disclosed include selecting a first key identifier (ID) for a first compartment of a compartmentalized process of a computing system, the first compartment including first private data; assigning a first extended page table (EPT) having at least one memory address including the first key ID; encrypting the first private data with a first key associated with the first key ID; and storing the encrypted first private data in a memory starting at the at least one memory address of the first EPT.

Fast key ID switching via extended paging for cryptographic intra-process isolation

An apparatus includes circuitry to receive a memory access request based on a memory address in a memory allocation of a program. The memory allocation is assigned to a slot of memory apportioned into a plurality of slots. The circuitry is to calculate an index based, at least in part, on whether a size of the slot exceeds a slot threshold size, and determine whether a buffer communicatively coupled to the circuitry includes a buffer entry corresponding to the index and containing a set of metadata associated with the memory allocation. Based on the slot size, the circuitry is to calculate the index by either determining a metadata virtual address or by determining a virtual address of a midpoint of the slot. The indexed data may include bounds and tag information for the circuitry to determine if a memory access is within the bounds and matches the tag value.

Efficient caching and queueing for per-allocation non-redundant metadata

An example method comprises storing, in a register, an encoded pointer to a memory location, where first context information is stored in first bits of the encoded pointer and a slice of a memory address of the memory location is encrypted and stored in second bits of the encoded pointer. The method further includes decoding the encoded pointer to obtain the memory address of the memory location, using the memory address obtained by decoding the encoded pointer to access encrypted data at the memory location, and decrypting the encrypted data based on a first key and a first tweak value. The first tweak value includes one or more bits derived, at least in part, from the encoded pointer.

Pointer based data encryption

Encryption interface technologies are described. A processor can include a system agent, an encryption interface, and a memory controller. The system agent can communicate data with a hardware functional block. The encryption interface can be coupled between the system agent and a memory controller. The encryption interface can receive a plaintext request from the system agent, encrypt the plaintext request to obtain an encrypted request, and communicate the encrypted request to the memory controller. The memory controller can communicate the encrypted request to a main memory of the computing device.

Encryption interface

Techniques for cryptographic computing isolation are described. A processor includes circuitry to be coupled to memory configured to store one or more instructions. The circuitry is to execute the one or more instructions to instantiate a first process based on an application. To instantiate the first process is to include creating a context table to be used by the first process, identifying a software component to be invoked during the first process, encrypting the software component using a first cryptographic key, and creating a first entry in the context table. The first entry is to include first context information identifying the encrypted software component and second context information representing the first cryptographic key. In more specific embodiments, third context information representing a first load address of the encrypted software component is stored in the first entry of the context table.

Cryptographic computing isolation for multi-tenancy and secure software components

A laminar flow purified air system includes a halo-shaped body configured to provide a laminar air flow barrier between a user of the existing hat and an ambient environment surrounding the user. Such a halo-shaped body has an air inlet and a laminar air outlet and a pressure chamber in fluid communication with both the air inlet and the laminar air outlet. The air inlet and the pressure chamber are configured to force laminar air out from the laminar air outlet and thereby create the laminar air flow barrier.

Laminar flow purified air system

Technologies provide domain isolation using encoded pointers to data and code. A system may be configured for decoding an encoded pointer to obtain a linear address of an encrypted code block of a first software component in memory. The first software component shares a linear address space of the memory with a plurality of software components. A processor uses the linear address to access the encrypted code block, determines a relative position of the encrypted code block within a memory slot of the linear address space, and decrypts the encrypted code block to generate a decrypted code block using a code key and a code tweak. The code tweak includes a relative position of the encrypted code block in the address space and domain metadata that uniquely identifies the software component. In some scenarios, the software component may be position independent code and may be relocatable to different address spaces.

Stateless and low-overhead domain isolation using cryptographic computing

Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

Cryptographic computing using encrypted base addresses and used in multi-tenant environments

A processor, a system, a machine readable medium, and a method. The processor comprises first circuitry to: encrypt a first code image using a first code key; load the encrypted first code image into a memory area allocated in memory for the first code image by an operating system miming on the processor; and send to the operating system a substitute key that corresponds to the first code key, wherein the first code key is concealed from the operating system; and an instruction cache including control circuitry; and second circuitry coupled to the instruction cache, the second circuitry to: receive the substitute key from the operating system; in response to a first request from the operating system to execute the first code image to instantiate a first process, perform a first cryptographic function using a hardware key to generate the first code key from the substitute key; and program the control circuitry of the instruction cache with the first code key to enable the first code image to be decrypted using the first code key.

Cryptographic computing in multitenant environments

Growing community of inventors

Beaverton, OR, United States of America

David M Durham